Needs work
Project:
Paragraphs
Version:
8.x-1.x-dev
Component:
Module: Type Permissions
Priority:
Normal
Category:
Bug report
Assigned:
Unassigned
Issue tags:
Reporter:
Created:
21 Nov 2019 at 13:41 UTC
Updated:
21 Apr 2026 at 19:35 UTC
Jump to comment: Most recent, Most recent file
Comments
Comment #2
a.dmitriiev commentedComment #3
berdirThis might have existed from before we had the logic in paragraphs itself? Does anything break if you just remove it? If yes, what if you return neutral() in that case instead of forbidden?
Comment #4
a.dmitriiev commentedRemoving that part allows non-priviledged users to see unpublished paragraphs. Trying with neutral() now. Will write back soon with the results.
Comment #5
a.dmitriiev commentedAccessResult::neutral() did the trick. New patch is attached.
Comment #6
a.dmitriiev commentedComment #7
berdirOk, that makes sense. It doesn't forbid nor explicitly allow access, letting others make that decision then.
I suppose one question is how it overlaps. E.g., if you have view unpublished but not view type X, should you then be able to see an unpublished paragraph of type X or only when you have both permissions?
tests are really important for access related things, so lets make whatever we decide explicit with test coverage.
\Drupal\paragraphs_type_permissions\Tests\ParagraphsTypePermissionsTest has some existing unpublished tests, making sure that users can't access them anymore. Lets extend that with a use that does have the unpublished permission.
Comment #8
a.dmitriiev commentedOk, thanks for reviewing this issue Berdir. I will check couple of more test cases and try to update \Drupal\paragraphs_type_permissions\Tests\ParagraphsTypePermissionsTest with more examples.
Comment #9
a.dmitriiev commentedI did some research and found that with patch from #5 it is possible to view unpublished paragraphs without permission to view paragraphs of certain type. I think this is wrong, so I am re-writing the patch and updating the tests.
Comment #10
a.dmitriiev commentedComment #11
a.dmitriiev commentedComment #12
mylies commentedsame issue for me - the paragraphs displays incorrectly with inline entity form mode if it's unpublished and current user have permission to view unpublished paragraphs
and here is new patch: the difference mostly in code stylistic + few access check added + notice that it's not good idea to cache the access check results when entity is unpublished
Comment #13
mylies commenteddamn, sorry - logic mismatch
Comment #15
dhruv panchal commentedTeam any solution we can get for this issue ?
Thanks,
Dhruv
Comment #16
matej.lehotsky commentedUpdated #10 patch, where i remove statement that prevent execute permission checks on "view" operation
Comment #17
matej.lehotsky commentedComment #18
llevante commentedComment #19
cgmonroe commentedIn case someone else needs this.
Here is a patch that combines the mutually exclusive patches from this issue (#18) and #3056358: Add option to set permission to view/edit/create/delete any paragraph type when using paragraphs type permissions (merge req).
This patch will display unpublished when using paragraphs_type_permissions AND add the CRUD permissions for 'any paragraph'.
The view any paragraph for anonymous avoids the common mistake of creating a paragraph and not granting view permission.